From: W.C.A. Wijngaards <wouter@nlnetlabs.nl>
Date: Wed, 22 Jul 2026 08:18:41 +0000 (+0200)
Subject: - Fix CVE-2026-55990, Packet of death for a DNSCrypt misconfigured
X-Git-Tag: release-1.25.2~4
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=ae1b3810cc3a8eb9b43c378289f74020b42aa7f4;p=thirdparty%2Funbound.git

- Fix CVE-2026-55990, Packet of death for a DNSCrypt misconfigured
  Unbound. Thanks to Qifan Zhang, Palo Alto Networks, for the report.
---

diff --git a/dnscrypt/dnscrypt.c b/dnscrypt/dnscrypt.c
index 08f9dcb8c..6f1a236ad 100644
--- a/dnscrypt/dnscrypt.c
+++ b/dnscrypt/dnscrypt.c
@@ -672,6 +672,8 @@ dnsc_find_cert(struct dnsc_env* dnscenv, struct sldns_buffer* buffer)
 	}
 	dnscrypt_header = (struct dnscrypt_query_header *)sldns_buffer_begin(buffer);
 	for (i = 0U; i < dnscenv->signed_certs_count; i++) {
+		if(!certs[i].keypair)
+			continue;
 		if (memcmp(certs[i].magic_query, dnscrypt_header->magic_query,
                    DNSCRYPT_MAGIC_HEADER_LEN) == 0) {
 			return &certs[i];
@@ -813,6 +815,7 @@ dnsc_parse_keys(struct dnsc_env *env, struct config_file *cfg)
 		sizeof *env->keypairs);
 	env->certs = sodium_allocarray(env->signed_certs_count,
 		sizeof *env->certs);
+	memset(env->certs, 0, env->signed_certs_count * sizeof(*env->certs));
 
 	cert_id = 0U;
 	keypair_id = 0U;
@@ -973,12 +976,19 @@ dnsc_create(void)
 int
 dnsc_apply_cfg(struct dnsc_env *env, struct config_file *cfg)
 {
+    int nkeys;
     if(dnsc_parse_certs(env, cfg) <= 0) {
         fatal_exit("dnsc_apply_cfg: no cert file loaded");
     }
-    if(dnsc_parse_keys(env, cfg) <= 0) {
+    nkeys = dnsc_parse_keys(env, cfg);
+    if(nkeys <= 0) {
         fatal_exit("dnsc_apply_cfg: no key file loaded");
     }
+    if((size_t)nkeys < env->signed_certs_count) {
+	fatal_exit("dnsc_apply_cfg: %u dnscrypt-provider-cert file(s) have no "
+		"matching dnscrypt-secret-key",
+		(unsigned)(env->signed_certs_count - (size_t)nkeys));
+    }
     randombytes_buf(env->hash_key, sizeof env->hash_key);
     env->provider_name = cfg->dnscrypt_provider;